xxrkktgn.cyou Open in urlscan Pro
103.143.159.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://xxrkktgn.cyou/
Submission: On August 04 via api (August 4th 2024, 12:34:06 pm UTC) from US — Scanned from DE

Summary HTTP 18 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 103.143.159.9, located in Hong Kong and belongs to HIITL-AS-AP Hong Kong FireLine Network LTD, HK. The main domain is xxrkktgn.cyou.
TLS certificate: Issued by R10 on July 21st 2024. Valid for: 3 months.

This is the only time xxrkktgn.cyou was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address		AS Autonomous System
18	103.143.159.9 103.143.159.9		136950 (HIITL-AS-...) (HIITL-AS-AP Hong Kong FireLine Network LTD)
18	1

18 103.143.159.9 (Hong Kong)

ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK)

xxrkktgn.cyou	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	xxrkktgn.cyou xxrkktgn.cyou	23 MB
18	1

	Domain	Requested by
18	xxrkktgn.cyou	xxrkktgn.cyou
18	1

This site contains links to these domains. Also see Links.

Domain
etchusces.selacain.shop
twitter.com

Subject Issuer	Validity	Valid
xxrkktg.cyou R10	`2024-07-21` - `2024-10-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xxrkktgn.cyou/
Frame ID: 5057BC5E0AB94963F1F6C30543D97E06
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram-Telegram

Page Statistics

18
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23453 kB
Transfer

23481 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://etchusces.selacain.shop/TG/win_x64-tg09.exe
Title: home

Search URL Search Domain Scan URL

URL: https://twitter.com/telegram
Title: Twitter

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
xxrkktgn.cyou/ 10 KB
2 KB 3153ms
333ms Document
text/html 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL

https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

ea3710df95218e0d9f76ddd57fe5ccaae3e8fe1280f892068f161f8e0055140f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 04 Aug 2024 12:33:36 GMT
etag: W/"669ce228-287c"
last-modified: Sun, 21 Jul 2024 10:25:44 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 style.css
xxrkktgn.cyou/style/ 62 KB
13 KB 668ms
667ms Stylesheet
text/css 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL

https://xxrkktgn.cyou/style/style.css

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

64e7a48d6b1ffad1238d25ecf2353fe3a008a7f3426a11138cf149bb07d4fbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Tue, 15 Aug 2023 17:37:44 GMT
server: nginx
etag: W/"64dbb7e8-f74a"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Mon, 05 Aug 2024 00:33:37 GMT

GET
H2 200 navright1.png
xxrkktgn.cyou/style/ 3 KB
3 KB 668ms
668ms Image
image/png 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/navright1.png

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

33d6be96b9ceed78dc9b32bb3fcdf2814836635d2d376d746f42728c35538f9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-a75"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2677
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 navright.png
xxrkktgn.cyou/style/ 1 KB
1 KB 669ms
669ms Image
image/png 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/navright.png

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-4f8"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1272
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 logo.png
xxrkktgn.cyou/style/ 11 KB
11 KB 658ms
656ms Image
image/png 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/logo.png

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

88afe4caad9d3ef9d7b4a5301d1b2b4378b54d233038079f0145e2f387f4eed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-2cb9"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 11449
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 session3.jpg
xxrkktgn.cyou/style/ 27 KB
27 KB 986ms
984ms Image
image/jpeg 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/session3.jpg

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

f123a86b52bc881b75b0afe9201a8cf1ed563c59e44b84c2c21f58e80ce3b44b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-6c4d"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 27725
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 window.jpg
xxrkktgn.cyou/style/ 31 KB
31 KB 987ms
985ms Image
image/jpeg 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/window.jpg

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

c443c78239489b2ee75618b26460dae55a87a132b74807780ceab30130eb7a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-7a9f"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 31391
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i9.gif
xxrkktgn.cyou/style/ 3 MB
3 MB 988ms
986ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i9.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

321fb7936dada76ce957347f61cd05be88581c5c3532d5cf87d346ba677474f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-2ffe3d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3145277
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i8.gif
xxrkktgn.cyou/style/ 3 MB
3 MB 988ms
986ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i8.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

3da30018745ee9d2032bb71f2907a2fa3647d1660d402200d35f161854b0ef48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-29342a"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2700330
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i7.gif
xxrkktgn.cyou/style/ 3 MB
3 MB 988ms
987ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i7.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

e21cceb8262a91f878fe4e5202139793e9cd3a02da2dd08d2dc4180cd29ac402

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-32c4dc"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3327196
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i6.gif
xxrkktgn.cyou/style/ 2 MB
2 MB 988ms
987ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i6.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

116029bd091ec390064879df7dad05e601e284413f53b9d51978875b85dc7471

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-24ffe3"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2424803
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i5.gif
xxrkktgn.cyou/style/ 2 MB
2 MB 988ms
987ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i5.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

f8152a8d500807f824571c3256320bbf578cdce88d45d0fd048a6422f71c272b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-1e8e27"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2002471
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i4.gif
xxrkktgn.cyou/style/ 3 MB
3 MB 988ms
987ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i4.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

b285715d34361c4fed5058a10eb830bf2dd61126518477ded340dd7f95221417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-343916"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3422486
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i3.gif
xxrkktgn.cyou/style/ 2 MB
2 MB 988ms
987ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i3.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

15d01829fac9057a922b9168d68d9ea940d7612b0128ae9b67fe69a1dd10e62d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-2267fe"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2254846
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i2.gif
xxrkktgn.cyou/style/ 2 MB
2 MB 989ms
989ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i2.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

abdbfc359a2954fadb7d335a20c2ae29cc5b00dbd538e88b03d612f978654e45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-219b67"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2202471
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 200 section4i1.gif
xxrkktgn.cyou/style/ 2 MB
2 MB 989ms
988ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktgn.cyou/style/section4i1.gif

Requested by

Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

58a9156f7cb557eb157598032fd67ade899a5a8b635455fbeb46c7bfa0f122e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-24dbae"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2415534
expires: Tue, 03 Sep 2024 12:33:37 GMT

GET
H2 404 skin.css
xxrkktgn.cyou/style/ 0
0 655ms
655ms Stylesheet
text/html 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xxrkktgn.cyou/style/skin.css
Requested by: Host: xxrkktgn.cyou
URL: https://xxrkktgn.cyou/style/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://xxrkktgn.cyou/style/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:37 GMT
server: nginx
content-length: 548
content-type: text/html

GET
H2 404 favicon.ico
xxrkktgn.cyou/ 548 B
611 B 334ms
334ms Other
text/html 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xxrkktgn.cyou/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

Referer: https://xxrkktgn.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 12:33:53 GMT
server: nginx
content-length: 548
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| navright

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xxrkktgn.cyou/style/skin.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xxrkktgn.cyou/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

xxrkktgn.cyou
103.143.159.9
116029bd091ec390064879df7dad05e601e284413f53b9d51978875b85dc7471
15d01829fac9057a922b9168d68d9ea940d7612b0128ae9b67fe69a1dd10e62d
321fb7936dada76ce957347f61cd05be88581c5c3532d5cf87d346ba677474f6
33d6be96b9ceed78dc9b32bb3fcdf2814836635d2d376d746f42728c35538f9e
3da30018745ee9d2032bb71f2907a2fa3647d1660d402200d35f161854b0ef48
58a9156f7cb557eb157598032fd67ade899a5a8b635455fbeb46c7bfa0f122e4
64e7a48d6b1ffad1238d25ecf2353fe3a008a7f3426a11138cf149bb07d4fbd7
88afe4caad9d3ef9d7b4a5301d1b2b4378b54d233038079f0145e2f387f4eed9
abdbfc359a2954fadb7d335a20c2ae29cc5b00dbd538e88b03d612f978654e45
b285715d34361c4fed5058a10eb830bf2dd61126518477ded340dd7f95221417
c443c78239489b2ee75618b26460dae55a87a132b74807780ceab30130eb7a68
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e21cceb8262a91f878fe4e5202139793e9cd3a02da2dd08d2dc4180cd29ac402
e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2
ea3710df95218e0d9f76ddd57fe5ccaae3e8fe1280f892068f161f8e0055140f
f123a86b52bc881b75b0afe9201a8cf1ed563c59e44b84c2c21f58e80ce3b44b
f8152a8d500807f824571c3256320bbf578cdce88d45d0fd048a6422f71c272b

xxrkktgn.cyou Open in urlscan Pro 103.143.159.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

18 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

23453 kBTransfer

23481 kBSize

0 Cookies

2 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

2 Console Messages

Security Headers

Indicators

xxrkktgn.cyou Open in urlscan Pro
103.143.159.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23453 kB
Transfer

23481 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!